CVE-2025-11849 Mammoth is vulnerable to Directory Traversal
An attacker can read arbitrary files or cause denial of service by crafting a malicious docx file with external image links processed by the Mammoth library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2025-11849?
CVE-2025-11849 is a medium-severity path traversal vulnerability in Mammoth, published on 17 Oct 2025. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Versions of the package mammoth from 0.3.25 and before 1.11.0; versions of the package mammoth from 0.3.25 and before 1.11.0; versions of the package mammoth before 1.11.0; versions of the package org.zwobble.mammoth:mammoth before 1.11.0 are vulnerable to Directory Traversal due to the lack of path or file type validation when processing a docx file containing an image with an external link (r:link attribute instead of embedded r:embed). The library resolves the URI to a file path and after reading, the content is encoded as base64 and included in the HTML output as a data URI. An attacker can read arbitrary files on the system where the conversion is performed or cause an excessive resources consumption by crafting a docx file that links to special device files such as /dev/random or /dev/zero.
Weakness: CWE-22
Which versions are affected by CVE-2025-11849?
9 open source packages ship an affected version, including mammoth, org.zwobble.mammoth:mammoth and Mammoth.
| Package | Affected | Fixed in |
|---|---|---|
mammoth PyPI | From 0.3.25 | 1.11.0 |
mammoth PyPI | From 0.3.25 | 1.11.0 |
mammoth PyPI | From 0.3.25 | 1.11.0 |
mammoth npm | From 0.3.25 | 1.11.0 |
mammoth npm | From 0.3.25 | 1.11.0 |
org.zwobble.mammoth:mammoth Maven | All versions | 1.11.0 |
3 more packages
org.zwobble.mammoth:mammoth Maven | All versions | 1.11.0 |
Mammoth NuGet | All versions | 1.11.0 |
Mammoth NuGet | All versions | 1.11.0 |
How do I fix CVE-2025-11849?
Upgrade mammoth to 1.11.0 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2025-11849 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-11849 exists.
Sources
Also known as GHSA-rmjr-87wv-gf87, PYSEC-2026-1603.